+
+ Version %s addressed some security issues.' ),
+ '6.0.3'
+ );
+ ?>
+ the release notes.' ),
+ sprintf(
+ /* translators: %s: WordPress version. */
+ esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+ sanitize_title( '6.0.3' )
+ )
+ );
+ ?>
+
the release notes.' );
+
+/* translators: 1: WordPress version number, 2: Link to update WordPress */
+__( 'Important! Your version of WordPress (%1$s) is no longer supported, you will not receive any security updates for your website. To keep your site secure, please update to the latest version of WordPress.' );
+
+/* translators: 1: WordPress version number, 2: Link to update WordPress */
+__( 'Important! Your version of WordPress (%1$s) will stop receiving security updates in the near future. To keep your site secure, please update to the latest version of WordPress.' );
diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index e39739883e..b154ff0320 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -2994,7 +2994,7 @@ function wp_ajax_query_attachments() {
// Filter query clauses to include filenames.
if ( isset( $query['s'] ) ) {
- add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
+ add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
}
/**
diff --git a/wp-admin/includes/post.php b/wp-admin/includes/post.php
index f3300fcf1e..bc034869af 100644
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -1302,7 +1302,7 @@ function wp_edit_attachments_query_vars( $q = false ) {
// Filter query clauses to include filenames.
if ( isset( $q['s'] ) ) {
- add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
+ add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
}
return $q;
diff --git a/wp-includes/blocks/legacy-widget.php b/wp-includes/blocks/legacy-widget.php
index c3aa55fdfe..94cfb9ba71 100644
--- a/wp-includes/blocks/legacy-widget.php
+++ b/wp-includes/blocks/legacy-widget.php
@@ -34,7 +34,7 @@ function render_block_core_legacy_widget( $attributes ) {
if ( isset( $attributes['instance']['encoded'], $attributes['instance']['hash'] ) ) {
$serialized_instance = base64_decode( $attributes['instance']['encoded'] );
- if ( wp_hash( $serialized_instance ) !== $attributes['instance']['hash'] ) {
+ if ( ! hash_equals( wp_hash( $serialized_instance ), (string) $attributes['instance']['hash'] ) ) {
return '';
}
$instance = unserialize( $serialized_instance );
diff --git a/wp-includes/blocks/navigation.php b/wp-includes/blocks/navigation.php
index 3388fb46f2..0e222985e9 100644
--- a/wp-includes/blocks/navigation.php
+++ b/wp-includes/blocks/navigation.php
@@ -626,7 +626,7 @@ function render_block_core_navigation( $attributes, $content, $block ) {
__( 'Close menu' ), // Close button label.
esc_attr( implode( ' ', $responsive_container_classes ) ),
esc_attr( implode( ' ', $open_button_classes ) ),
- safecss_filter_attr( $colors['overlay_inline_styles'] ),
+ esc_attr( safecss_filter_attr( $colors['overlay_inline_styles'] ) ),
__( 'Menu' ),
$toggle_button_content
);
diff --git a/wp-includes/blocks/post-featured-image.php b/wp-includes/blocks/post-featured-image.php
index 6ac274c4ca..87a9546a47 100644
--- a/wp-includes/blocks/post-featured-image.php
+++ b/wp-includes/blocks/post-featured-image.php
@@ -45,7 +45,7 @@ function render_block_core_post_featured_image( $attributes, $content, $block )
if ( ! empty( $attributes['scale'] ) ) {
$image_styles .= "object-fit:{$attributes['scale']};";
}
- $featured_image = str_replace( 'src=', 'style="' . esc_attr( $image_styles ) . '" src=', $featured_image );
+ $featured_image = str_replace( '
$featured_image";
diff --git a/wp-includes/blocks/rss.php b/wp-includes/blocks/rss.php
index 0edbc90490..e32155195a 100644
--- a/wp-includes/blocks/rss.php
+++ b/wp-includes/blocks/rss.php
@@ -20,7 +20,7 @@ function render_block_core_rss( $attributes ) {
$rss = fetch_feed( $attributes['feedURL'] );
if ( is_wp_error( $rss ) ) {
- return '
' . __( 'RSS Error:' ) . ' ' . $rss->get_error_message() . '
';
+ return '
' . __( 'RSS Error:' ) . ' ' . esc_html( $rss->get_error_message() ) . '
';
}
if ( ! $rss->get_item_quantity() ) {
@@ -48,8 +48,8 @@ function render_block_core_rss( $attributes ) {
if ( $date ) {
$date = sprintf(
' ',
- date_i18n( get_option( 'c' ), $date ),
- date_i18n( get_option( 'date_format' ), $date )
+ esc_attr( date_i18n( get_option( 'c' ), $date ) ),
+ esc_attr( date_i18n( get_option( 'date_format' ), $date ) )
);
}
}
diff --git a/wp-includes/blocks/search.php b/wp-includes/blocks/search.php
index 94ec6fc4ac..2d01d8a70d 100644
--- a/wp-includes/blocks/search.php
+++ b/wp-includes/blocks/search.php
@@ -287,12 +287,12 @@ function styles_for_block_core_search( $attributes ) {
// Add color styles.
$has_text_color = ! empty( $attributes['style']['color']['text'] );
if ( $has_text_color ) {
- $button_styles[] = sprintf( 'color: %s;', esc_attr( $attributes['style']['color']['text'] ) );
+ $button_styles[] = sprintf( 'color: %s;', $attributes['style']['color']['text'] );
}
$has_background_color = ! empty( $attributes['style']['color']['background'] );
if ( $has_background_color ) {
- $button_styles[] = sprintf( 'background-color: %s;', esc_attr( $attributes['style']['color']['background'] ) );
+ $button_styles[] = sprintf( 'background-color: %s;', $attributes['style']['color']['background'] );
}
$has_custom_gradient = ! empty( $attributes['style']['color']['gradient'] );
@@ -301,9 +301,9 @@ function styles_for_block_core_search( $attributes ) {
}
return array(
- 'input' => ! empty( $input_styles ) ? sprintf( ' style="%s"', safecss_filter_attr( implode( ' ', $input_styles ) ) ) : '',
- 'button' => ! empty( $button_styles ) ? sprintf( ' style="%s"', safecss_filter_attr( implode( ' ', $button_styles ) ) ) : '',
- 'wrapper' => ! empty( $wrapper_styles ) ? sprintf( ' style="%s"', safecss_filter_attr( implode( ' ', $wrapper_styles ) ) ) : '',
+ 'input' => ! empty( $input_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $input_styles ) ) ) ) : '',
+ 'button' => ! empty( $button_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $button_styles ) ) ) ) : '',
+ 'wrapper' => ! empty( $wrapper_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $wrapper_styles ) ) ) ) : '',
);
}
diff --git a/wp-includes/blocks/widget-group.php b/wp-includes/blocks/widget-group.php
index 6cf6442346..8c8584b296 100644
--- a/wp-includes/blocks/widget-group.php
+++ b/wp-includes/blocks/widget-group.php
@@ -28,7 +28,7 @@ function render_block_core_widget_group( $attributes, $content, $block ) {
$html = '';
if ( ! empty( $attributes['title'] ) ) {
- $html .= $before_title . $attributes['title'] . $after_title;
+ $html .= $before_title . esc_html( $attributes['title'] ) . $after_title;
}
$html .= '
';
diff --git a/wp-includes/class-wp-date-query.php b/wp-includes/class-wp-date-query.php
index 1978afe762..a10c79163c 100644
--- a/wp-includes/class-wp-date-query.php
+++ b/wp-includes/class-wp-date-query.php
@@ -149,8 +149,8 @@ public function __construct( $date_query, $default_column = 'post_date' ) {
return;
}
- if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
- $this->relation = 'OR';
+ if ( isset( $date_query['relation'] ) ) {
+ $this->relation = $this->sanitize_relation( $date_query['relation'] );
} else {
$this->relation = 'AND';
}
@@ -219,6 +219,9 @@ public function sanitize_query( $queries, $parent_query = null ) {
$this->validate_date_values( $queries );
}
+ // Sanitize the relation parameter.
+ $queries['relation'] = $this->sanitize_relation( $queries['relation'] );
+
foreach ( $queries as $key => $q ) {
if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) {
// This is a first-order query. Trust the values and sanitize when building SQL.
@@ -1040,4 +1043,20 @@ public function build_time_query( $column, $compare, $hour = null, $minute = nul
return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
}
+
+ /**
+ * Sanitizes a 'relation' operator.
+ *
+ * @since 6.0.3
+ *
+ * @param string $relation Raw relation key from the query argument.
+ * @return string Sanitized relation ('AND' or 'OR').
+ */
+ public function sanitize_relation( $relation ) {
+ if ( 'OR' === strtoupper( $relation ) ) {
+ return 'OR';
+ } else {
+ return 'AND';
+ }
+ }
}
diff --git a/wp-includes/class-wp-query.php b/wp-includes/class-wp-query.php
index e7eda7bab7..edf6799cb6 100644
--- a/wp-includes/class-wp-query.php
+++ b/wp-includes/class-wp-query.php
@@ -444,6 +444,14 @@ class WP_Query {
*/
public $thumbnails_cached = false;
+ /**
+ * Controls whether an attachment query should include filenames or not.
+ *
+ * @since 6.0.3
+ * @var bool
+ */
+ protected $allow_query_attachment_by_filename = false;
+
/**
* Cached list of search stopwords.
*
@@ -1414,8 +1422,13 @@ protected function parse_search( &$q ) {
$q['search_orderby_title'][] = $wpdb->prepare( "{$wpdb->posts}.post_title LIKE %s", $like );
}
- $like = $n . $wpdb->esc_like( $term ) . $n;
- $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
+ $like = $n . $wpdb->esc_like( $term ) . $n;
+
+ if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
+ $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s) $andor_op (sq1.meta_value $like_op %s))", $like, $like, $like, $like );
+ } else {
+ $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
+ }
$searchand = ' AND ';
}
@@ -1810,6 +1823,16 @@ public function get_posts() {
// Fill again in case 'pre_get_posts' unset some vars.
$q = $this->fill_query_vars( $q );
+ /**
+ * Filters whether an attachment query should include filenames or not.
+ *
+ * @since 6.0.3
+ *
+ * @param bool $allow_query_attachment_by_filename Whether or not to include filenames.
+ */
+ $this->allow_query_attachment_by_filename = apply_filters( 'wp_allow_query_attachment_by_filename', false );
+ remove_all_filters( 'wp_allow_query_attachment_by_filename' );
+
// Parse meta query.
$this->meta_query = new WP_Meta_Query();
$this->meta_query->parse_query_vars( $q );
@@ -2241,7 +2264,7 @@ public function get_posts() {
}
}
- if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) ) {
+ if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) || ! empty( $this->allow_query_attachment_by_filename ) ) {
$groupby = "{$wpdb->posts}.ID";
}
@@ -2318,6 +2341,10 @@ public function get_posts() {
}
$where .= $search . $whichauthor . $whichmimetype;
+ if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
+ $join .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";
+ }
+
if ( ! empty( $this->meta_query->queries ) ) {
$clauses = $this->meta_query->get_sql( 'post', $wpdb->posts, 'ID', $this );
$join .= $clauses['join'];
diff --git a/wp-includes/comment.php b/wp-includes/comment.php
index 0d5de2681d..c3353c32f9 100644
--- a/wp-includes/comment.php
+++ b/wp-includes/comment.php
@@ -2464,6 +2464,15 @@ function wp_update_comment( $commentarr, $wp_error = false ) {
}
}
+ $filter_comment = false;
+ if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
+ $filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' );
+ }
+
+ if ( $filter_comment ) {
+ add_filter( 'pre_comment_content', 'wp_filter_kses' );
+ }
+
// Escape data pulled from DB.
$comment = wp_slash( $comment );
@@ -2474,6 +2483,10 @@ function wp_update_comment( $commentarr, $wp_error = false ) {
$commentarr = wp_filter_comment( $commentarr );
+ if ( $filter_comment ) {
+ remove_filter( 'pre_comment_content', 'wp_filter_kses' );
+ }
+
// Now extract the merged array.
$data = wp_unslash( $commentarr );
diff --git a/wp-includes/customize/class-wp-customize-header-image-control.php b/wp-includes/customize/class-wp-customize-header-image-control.php
index 82c1714261..701b9ea102 100644
--- a/wp-includes/customize/class-wp-customize-header-image-control.php
+++ b/wp-includes/customize/class-wp-customize-header-image-control.php
@@ -130,10 +130,10 @@ public function print_header_image_template() {
<# } else { #>
<# if ( data.type === 'uploaded' ) { #>
@@ -158,7 +158,7 @@ public function print_header_image_template() {
<# } else { #>
-
![{{{data.header.alt_text || data.header.description}}}]({{{data.header.thumbnail_url}}})
+
![{{data.header.alt_text || data.header.description}}]({{data.header.thumbnail_url}})
<# } #>
<# } else { #>
diff --git a/wp-includes/customize/class-wp-customize-site-icon-control.php b/wp-includes/customize/class-wp-customize-site-icon-control.php
index 7b689657fa..942000a57d 100644
--- a/wp-includes/customize/class-wp-customize-site-icon-control.php
+++ b/wp-includes/customize/class-wp-customize-site-icon-control.php
@@ -68,7 +68,7 @@ public function content_template() {
-
<# print( '' ) #>
+
<# print( '' ) #>
diff --git a/wp-includes/deprecated.php b/wp-includes/deprecated.php
index ec4c4678f5..013694391c 100644
--- a/wp-includes/deprecated.php
+++ b/wp-includes/deprecated.php
@@ -4311,3 +4311,20 @@ function wp_skip_spacing_serialization( $block_type ) {
function wp_add_iframed_editor_assets_html() {
_deprecated_function( __FUNCTION__, '6.0.0' );
}
+
+/**
+ * Filter the SQL clauses of an attachment query to include filenames.
+ *
+ * @since 4.7.0
+ * @deprecated 6.0.3
+ * @access private
+ *
+ * @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,
+ * DISTINCT, fields (SELECT), and LIMITS clauses.
+ * @return array The unmodified clauses.
+ */
+function _filter_query_attachment_filenames( $clauses ) {
+ _deprecated_function( __FUNCTION__, '4.9.9', 'add_filter( "wp_allow_query_attachment_by_filename", "__return_true" )' );
+ remove_filter( 'posts_clauses', __FUNCTION__ );
+ return $clauses;
+}
\ No newline at end of file
diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index b4ea6fbce0..56bfa8cbc0 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -3580,10 +3580,12 @@ function wp_nonce_ays( $action ) {
} else {
$html = __( 'The link you followed has expired.' );
if ( wp_get_referer() ) {
+ $wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
+ $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
$html .= '